High · CVSS 7.5CVE-2026-15955

IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file pathsCVE-2026-15955

Answer in brief

CVE-2026-15955 records a High severity (CVSS 7.5) vulnerability in IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths. The current sources do not mark it as known exploited. The current feed maps IBM/Db2 (generic), IBM/Db2 (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 14, 2026Updated Sep 16, 2026Source checked Oct 30, 2026First seen by HOL Sep 14, 2026Material review Sep 16, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.5
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps IBM/Db2 (generic), IBM/Db2 (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
IBM/Db2generic	>=11.5.0 <=11.5.9 \|\| >=12.1.0 <=12.1.5	Not reported
IBM/Db2generic	11.5.0 \|\| 12.1.0	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for IBM/Db2, IBM/Db2.
Review the reported fix. Source-reported solution: Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4, and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/node/7267513 Security Update #89304 or later for V12.1.5 available at this link: https://www.ibm.com/support/pages/node/7282633 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

Evidence timeline and material changes

Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 14, 2026

Sources and claim methodology

Source referenceibm.com

Upstream source description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

Quoted source text, attributed separately from HOL analysis.

Affected scope and exposure questions

The current feed maps IBM/Db2 (generic), IBM/Db2 (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
IBM/Db2generic	>=11.5.0 <=11.5.9 \|\| >=12.1.0 <=12.1.5	Not reported
IBM/Db2generic	11.5.0 \|\| 12.1.0	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for IBM/Db2, IBM/Db2.

Review the reported fix. Source-reported solution: Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4, and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/node/7267513 Security Update #89304 or later for V12.1.5 available at this link: https://www.ibm.com/support/pages/node/7282633 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.